Close
Enter your
text here

Privacy

Last updated: October 8, 2026

GRTforms (“the App”, “the Product”) is a hosted online forms product from GrtLabs Inc (“we”). You create a GRTforms account, build forms, publish public form URLs, and collect submissions. This policy describes what we collect, what we store, how we use it, and what we do not do. It is not a review by a lawyer.

Information the App can access

When you sign up for GRTforms, you create a GRTforms account with your email and credentials (password or magic-link email sign-in). Google sign-in is coming soon.

Depending on how you use the product, we handle:

  • Account data. Email address and credentials (or credential hashes) used to sign up, log in, and manage your dashboard. Google sign-in is coming soon; if and when you use it, we store your Google account ID and email, but not Google access tokens.
  • Form definitions. The forms you create: field labels, types, layout, validation rules, conditional logic rules, custom CSS, hidden-field settings, tracking IDs you add, and publish/share settings.
  • Submissions. Answers that respondents enter on your public forms at /f/[slug], including hidden-field values (for example UTM parameters from the URL) and uploaded files. With each submission we also store the submitter’s IP address, browser user agent, referrer, and time.
  • E-signatures. When a form has a Signature field, we store the signature image, the typed name, a timestamp, and the signer’s IP address and user agent. These are deleted along with the submission.
  • Security data. Blocked IP addresses and ranges you add (with the note, expiry, who added it, and whether it covers one form or the whole account), abuse alert records (the rule that fired, counts, and top IPs), and an export log (who exported, how many rows, and in which format).
  • Form analytics. Public forms set a first-party cookie named grtforms_vid containing a random ID, kept for 1 year. We store only hashed visit counts for analytics, not IP addresses.

Login, signup, and magic-link sign-in do not store your IP address. IPs are used in memory for rate limiting and sent to Cloudflare for the CAPTCHA check described below.

Information we store ourselves

GRTforms uses Postgres for persistence, hosted with the App on Railway. We store account records, form definitions, submissions (with the metadata above), e-signature records, security data, and analytics counts.

Public forms collect whatever fields the form owner configures. For respondent data collected through a form you publish:

  • You (the form owner) are the data controller for that respondent data.
  • GrtLabs Inc is the processor / host that stores and displays that data so you can manage submissions in the product.

We do not place our own advertising cookies or pixels on public forms or on sites where you embed a form. If you add tracking IDs to a form (Meta Pixel, Google Tag Manager, Google Analytics 4, or HubSpot), the public form loads those scripts and they follow your settings and those providers’ policies. Session cookies are used for your logged-in dashboard.

How we use it

We use this information to:

  • Provide signup, login (including magic-link email sign-in), and the dashboard
  • Let you build, lay out, style, apply conditional logic to, publish, and share forms
  • Accept and store submissions on public forms
  • Show submissions with search, filters, pagination, view/edit/delete, bulk select, and Excel / CSV / PDF export
  • Email form owners when a submission arrives, and email abuse alerts
  • Protect your forms from spam and abuse: IP blocking, abuse alerts, pause form, auto-protect, the Suspicious filter, and CAPTCHA
  • Show form analytics

We do not use this information to advertise to your form respondents, and we do not sell it.

Who else handles it

  • Railway hosts the App and the Postgres database. It is a service provider for running the App, not a buyer of the data.
  • Cloudflare Turnstile runs the CAPTCHA check on signup, login, and magic-link sign-in, and on any form where Require CAPTCHA is on. The CAPTCHA token and the visitor’s IP address are sent to Cloudflare for verification, under Cloudflare’s own privacy policy.
  • Mailgun sends magic-link sign-in emails, owner notification emails when a submission arrives, and abuse alert emails. Mailgun receives the recipient email address and the message content (for submission notifications, that can include submitted answers). Respondent confirmation emails are not available yet.
  • Webhooks. If you add a webhook URL to a form, the full submission, including IP address and user agent, is sent to that URL.
  • Tracking providers you add (Meta, Google, HubSpot) receive data from the public form according to the tags you configure.
  • If you embed a form (iframe or JS embed) on your own site, visitors load the form from grtforms.com; your site may have its own privacy practices separate from this policy.

We may also disclose information if a law, subpoena, or court order requires it, or to protect our rights. We do not sell personal information.

Your rights

If you are in the European Economic Area or the United Kingdom, you can ask us to access, correct, or delete personal information we hold about you. Email [email protected]. We process account and form data to provide the Product you signed up for. Form owners control what respondent fields they collect; we host that data as described above. The App is hosted in the United States.

If you are a California resident, you can ask what we collected, ask us to delete it, and ask us not to sell it. We do not sell personal information. Categories we hold typically include account contact details, form configuration, submission content and metadata (IP address, user agent, referrer), and security records. The source is your GRTforms account and the public forms you publish. The purpose is operating and protecting the hosted forms product. To make a request, email [email protected] or use the GRTforms support page at https://grtlabs.com/apps/grtforms/support/. You can also call 713.714.6849.

Form owners who collect personal data from respondents should handle respondent requests according to their own obligations. We can help with account-level and hosting-related requests as described on the support page.

How long we keep it

We keep account data, form definitions, and submissions in Postgres while your account and forms remain active. Deleting a submission removes it, including its e-signature record, from the live store. IP addresses can also remain in blocked-IP lists (until the block expires or is removed), abuse alert records, and export logs after a submission is deleted. If you want an account closed or broader deletion, email [email protected] and we will work through what we can remove from our systems.

Changes

We may update this policy when the Product’s practices change. The date at the top is the latest version. The current page is https://grtlabs.com/apps/grtforms/privacy/.

Contact

GrtLabs Inc
Email: [email protected]
Phone: 713.714.6849
United States: 10101 Southwest Fwy #431, Houston, TX 77074
Canada: 163 Binder Twine Trail, Brampton, ON L6X 4V6